{
  "prepared_at_sydney": "2026-10-30",
  "scope": "Automated local Signer JavaScript-engine tests and published direct-download APK inspection; not an independent audit or native-app test.",
  "release_engines": [
    {
      "name": "iOS release engine",
      "source_commit": "f621372ddeb6740328af0ccfbdd5e28c3f7c9358",
      "tag": "v1.0.0",
      "tests_passed": 210,
      "tests_failed": 0,
      "rebuilt_sha256": "6933d0d8a6f60faa8222506ac0bd7eef80eb884c9f73e31e9f354b4740f21077",
      "matches_tracked_bundle": true
    },
    {
      "name": "Android release engine",
      "source_commit": "71af693db0c9e728b906c2112e14bab561ed308c",
      "tag": "android-v1.0.0",
      "tests_passed": 217,
      "tests_failed": 0,
      "rebuilt_sha256": "4b3717599e8ee3ed9d2480e640e7203731543cc8ab0f2c3cec3b78e6f400fa19",
      "matches_tracked_bundle": true,
      "metadata_caveat": "Build changes only file field from stale iOS path BitToolSigner/Resources/signer.js to Android path core/engine/src/main/assets/engine/signer.js; SHA256 and bytes identical."
    }
  ],
  "apk": {
    "download_url": "https://bitbill.oss-accelerate.aliyuncs.com/BitToolSigner-1.0.0-1000001.apk",
    "package": "com.bittool.signer",
    "version": "1.0.0",
    "version_code": 1000001,
    "bytes": 20791832,
    "sha256": "109dbf5c622ee77672904c34a10229df3c9b0eac45b07096c510b1e1e169c2a4",
    "signature_schemes_verified": [
      "v2",
      "v3"
    ],
    "signer_certificate_sha256": "af41ed101765393ae89038eb4c6fc7fa96d930f6fcd76b881437a39b5a9e4631",
    "certificate_matches_publisher_reference": true,
    "embedded_engine_sha256": "4b3717599e8ee3ed9d2480e640e7203731543cc8ab0f2c3cec3b78e6f400fa19",
    "matches_rebuilt_android_release_engine": true,
    "matches_ios_v1_0_0_release_engine": false,
    "internet_permission_present_in_parsed_manifest": false
  },
  "apk_engine_vm_smoke": {
    "tested_at": "2026-10-29T23:04:42.411Z",
    "node": "v20.20.2",
    "bundle_sha256": "4b3717599e8ee3ed9d2480e640e7203731543cc8ab0f2c3cec3b78e6f400fa19",
    "scope": "Local VM execution of the official APK JavaScript asset. Not a native-device test, independent audit, or Sparrow/Cove compatibility certification.",
    "passed": 8,
    "failed": 0,
    "results": [
      {
        "id": "native-psbt-v0",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "crypto-psbt",
        "request_frames": 2,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "native-psbt-v2",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "psbt",
        "request_frames": 3,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "taproot-psbt-v0",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "crypto-psbt",
        "request_frames": 2,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "taproot-psbt-v2",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "psbt",
        "request_frames": 2,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "nested-psbt-v0",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "crypto-psbt",
        "request_frames": 3,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "legacy-psbt-v0",
        "status": "pass",
        "scope": "published APK JS bundle executed in Node VM",
        "transport": "crypto-psbt",
        "request_frames": 2,
        "response_frames": 3,
        "signature_verified": true,
        "unsigned_transaction_preserved": true,
        "finalized_in_scure": true
      },
      {
        "id": "testnet-rejected",
        "status": "pass",
        "expected_rejection": "NETWORK"
      },
      {
        "id": "wrong-fingerprint-rejected",
        "status": "pass",
        "expected_rejection": "FINGERPRINT"
      }
    ]
  },
  "runtime_caveat": "Node v20.20.2 webcrypto supplied a host CSPRNG. The Android/iOS native bridge and native UI were not exercised.",
  "fixtures": {
    "file": "fixtures/public_psbt_ur_fixtures.json",
    "count": 6,
    "network": "mainnet-syntax-only",
    "notice": "PUBLIC BIP39 TEST MNEMONIC ONLY. NEVER FUND. FABRICATED INPUTS. NO BROADCAST.",
    "sha256": "415f9df944ee294a7870efbdf0e2383e98c1a5944cc2cf6f4028e8c265846f23",
    "funding_scope": "No real funds used or real UTXOs referenced in this run. No claim about historical on-chain activity of public test addresses."
  },
  "bitcoin_mainnet_only_sources": [
    "https://github.com/bitbill/bittool-signer-android/blob/71af693db0c9e728b906c2112e14bab561ed308c/engine/src/bitcoin.js#L133",
    "https://github.com/bitbill/bittool-signer-android/blob/71af693db0c9e728b906c2112e14bab561ed308c/engine/src/bitcoin.js#L218"
  ],
  "limits": [
    "No full APK/AAB build was attempted; no byte-for-byte full application reproducibility claim.",
    "No App Store IPA inspected; iOS release tag engine differs from current iOS main and Android release.",
    "No phone runtime, biometrics, backup or camera scan test executed.",
    "No Sparrow or Cove application runtime test executed; no third-party compatibility certification.",
    "Publisher regression tests and this small VM smoke suite are not an independent security audit.",
    "APK permissions and source checks do not prove all device/runtime behavior."
  ],
  "device_companion_tests_completed": 0,
  "wallet_specific_tests_completed": 0,
  "known_security_findings_status": "Unchanged; no finding is declared fixed by this evaluation."
}